Cloudflare Remote vs Hitchecker

Cloudflare Remote is a mobile control room for your Cloudflare account, built for people who need to fix things without waiting until they are back at a laptop. Manage DNS, firewall rules, cache behaviour, tunnels, Workers, SSL and analytics from your iPhone, in a fast native interface. DNS & DOMAINS • Manage records of every common type (A, AAAA, CNAME, MX, TXT, NS, SRV, PTR) • Create, edit and delete records instantly, with the proxy toggle on each one • Export a whole zone as a BIND file, or import one • DNSSEC status and configuration • Multi-account support with fast switching ANALYTICS • Requests, bandwidth, unique visitors and threats • Cache hit ratio, cached against uncached traffic • HTTP status distribution and top countries • 24 hours, 7 days or 30 days SECURITY • Firewall rules with Cloudflare's own expression language • WAF managed rulesets • IP access rules by IP, CIDR, country or ASN • Rate limiting rules • Live security events, with the rule that caught each request • Security level, up to Under Attack mode • SSL/TLS mode, certificates and minimum TLS version PERFORMANCE & RULES • Cache rules and transform rules • Page rules and redirect rules • Cache purge, everything or by URL • Development mode • Browser cache TTL, Brotli, HTTP/2, HTTP/3, IPv6, WebSockets, Always Online TUNNELS & ZERO TRUST • Cloudflare Tunnel health, active connections and their locations • Public hostnames you can add and edit in place • Protect any hostname with Zero Trust Access, and decide who may reach it DEVELOPERS • Workers & Pages deployments, with one-tap rollback and retry • Workers scripts and the routes bound to each domain • R2 buckets AVAILABILITY • Load balancers with their origin pools • Health checks EMAIL ROUTING • Forward addresses on your domain to a personal inbox • Manage routing rules and destinations AUDIT • See who changed what on the account, and when PRIVACY & SECURITY • Your API key or token is kept in the device Keychain, pinned to that device, so it is excluded from iCloud and iTunes backups • It is sent to nobody but Cloudflare's own API. There is no server behind this app to send it to • Optional Face ID, Touch ID or passcode lock in front of the app • Sign in with a scoped API Token and grant only the permissions you choose • No analytics SDK, no advertising SDK, no tracking, no usage data collected SUBSCRIPTIONS Premium unlocks every domain on your account, plus tunnels, Access, Workers & Pages, R2, cache rules, transform rules and load balancers. Available monthly, yearly, or as a one-time lifetime purchase. A multi-account add-on is included with lifetime. Subscriptions renew automatically unless cancelled at least 24 hours before the end of the current period. Manage or cancel them in your Apple Account settings. IMPORTANT Cloudflare Remote needs a Cloudflare account, which it manages but does not create. This is an independent third-party client built on the Cloudflare API and is not affiliated with, endorsed by, or sponsored by Cloudflare, Inc. Terms of Use: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ Privacy Policy: https://emrekeles.com/cloudflare-privacy.html

Most tools for proxy configs begin with the config. Hitchecker begins with the network you are already on: the address the internet sees you at, how it is classified, and which DNS resolvers your iPhone is really asking. The links other people hand you come after that. WHAT YOUR CONNECTION LOOKS LIKE FROM OUTSIDE The Network tab opens with what iOS already knows, before anything leaves: Wi-Fi, cellular or wired, metered, Low Data. Ask for the full check and our server describes the address your request arrived from — the public IP, where it maps to, the operator and network type behind it, and a risk figure with a word beside it. Reputation flags — VPN, proxy, Tor, hosting — appear when they apply. WHO IS ANSWERING YOUR DNS Which resolvers this device uses is read locally, then identified: operator, country, and whether it is a public resolver or your network's own. Their answers get checked too. Three anchor names — dns.google, one.one.one.one and dns.quad9.net — are looked up twice, once through your own resolvers and once through Cloudflare's public DNS, which nothing on your local network can rewrite. Agreement reads as nothing unusual; disagreement is shown as an observation, with the addresses that came back. A measurement, not a verdict. AND A SERVER THAT ISN'T YOURS For VLESS, VMess, Trojan and Shadowsocks you can ask whether the server is still alive — five a day free, unlimited on Pro. Your iPhone stays out of it: the link goes to a server we run, which makes the connection itself and reports whether it answered, the round-trip time, throughput each way, and the same portrait of the address traffic would surface from. WHAT ACTUALLY LEAVES THIS IPHONE No account. No analytics. No advertising. No third-party SDKs. Hitchecker carries none of your traffic and never connects your device to a config you inspect. Only these go out, each at your request: the connection check's own request; the addresses of your DNS resolvers, so the tester can name who runs them; the canary lookups to Cloudflare; the config link you choose to test; a subscription URL fetched from your provider. Both checks sit behind a one-time consent screen, and the tester runs under a no-logging policy for links and IP addresses. THE LINK ITSELF, OPENED ON THE DEVICE Paste text, scan a QR code, pick a screenshot out of Photos, or send a link from another app. Twelve formats are decoded on the device: VLESS, VMess, Trojan, Shadowsocks, ShadowsocksR, Hysteria, Hysteria 2, TUIC, SOCKS, HTTP proxy, WireGuard and OpenVPN. Each becomes plain labeled rows — transport, encryption, Reality keys, server names, fingerprints, timeouts — and fields Hitchecker cannot place get their own heading. Secrets stay covered until you tap them. THIRTEEN CHECKS, GRADED NOTE, RISK OR SEVERE Certificate validation switched off, a password in the clear, no transport encryption, ciphers long past trustworthy, an empty server name, sample credentials nobody replaced, half-configured Reality, a WebSocket on a plaintext port. Whatever fires is listed with its grade — Note, Risk or Severe — for everyone, and a clean config is told so in full, paid or not. Pro adds the reasoning behind each finding and what to change. A LIBRARY THAT CAN BE SWITCHED OFF Free keeps 40 configs and 15 favorites, searchable; Pro removes the ceiling. Want no history at all? Switch saving off and, from then on, no analyzed config is stored on the device — anything saved earlier stays until you delete it, and your own settings are kept locally either way. Any config can be passed on as a QR image, or as a text file when it is too big to scan — large OpenVPN profiles usually are — with a reminder that either carries the password. PRO, PAID ONCE, NEVER A SUBSCRIPTION Past unlimited testing and history: batch work on many links, a subscription URL or an imported file; two configs compared field by field, where both sides must be the same format; your library exported as Text, Markdown or JSON.